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APOLLO EXPERIENCE REPORT 

SPACECRAFT PYROTECHNIC SYSTEMS 

By Mario J. Falbo and Robert L. Robinson 
Manned Spacecraft Center 

SUMMARY 


Pyrotechnic devices were used in the Apollo spacecraft systems to perform the 
following functions: launch -escape -tower separation, separation-rocket ignition, sepa- 
ration of the booster stage from the lunar module, forward -heat -shield jettison, 
spacecraft/lunar module adapter panel separation, lunar module landing -gear deploy- 
ment, pressurization and activation of the lunar module propulsion systems, deployment 
and release of parachutes, opening and closing of electrical circuits, execution of 
timing and delayed-time functions, and cutting of lines and cables. 

Requirements for high reliability and maximum safety were met with devices of 
minimum weight and volume. The capabilities of the devices ranged from relatively 
low-energy charges for puncturing gas bottles to high-energy charges for cutting 
0. 153 -inch -thick steel. 

Conventional electrical and mechanical components were used, when possible, to 
minimize potential design problems. Selection of proper explosive materials also was 
very important. Test and evaluation programs were continued after the flight qualifica- 
tion of the devices to understand better the reliability, safety, vulnerability, and output 
factors. Redundancy and common usage enhanced confidence in the overall pyrotechnic 
systems. To protect against spurious forms of electrical energy, standard safety 
practices were followed in the design of the electrical systems. 

No failures of pyrotechnic devices have been detected during any of the Apollo 
missions. This reliability probably is attributable, at least in large measure, to the 
conservative design, closely controlled manufacturing processes and testing techniques, 
and thorough acceptance procedures. 


INTRODUCTION 


The total number of pyrotechnic devices in the Apollo spacecraft systems varied 
for different spacecraft. More than 210 pyrotechnic devices were used per flight to 
perform a myriad of onboard, inflight, timed, and controlled tasks automatically or on 
command in the Apollo spacecraft systems. All devices required high reliability and 
safety. Most were classified as either crew-safety critical or mission critical, because 



improper operation or failure to operate could have resulted in loss of the crew, in 
failure to meet a mission objective, or in an aborted mission. 

The high specific energy and other unique properties of explosive and pyrotechnic 
materials afforded the method for providing a large energy source in a small package. 

By using explosives, numerous functions were accomplished reliably and safely with 
minimum weight and space limitations. These properties, coupled with the capability 
of the pyrotechnic devices to release energy at a high rate in a short time, made wide 
acceptance in the Apollo Program a natural result. 

Confidence in the subsystems was further enhanced with maximum use of redun- 
dancy. When complete system or device redundancy was not possible because of space 
or weight limitations, redundant cartridges or single cartridges with dual initiators 
were used. Two separate and electrically independent systems operated in parallel and 
provided complete redundancy in the firing circuitry. 

Early in the Apollo Program, the concept of modular cartridge assemblies based 
on a standardized hot-wire initiator was adopted to avoid the expense and time involved 
in extensive testing associated with the development of different initiators for various 
applications. A higher confidence in reliability was achieved by the use of standardized, 
high-volume items. Components, subassemblies, and assemblies were qualified seri- 
ally during development of complete systems. Thus, confidence in the reliability of the 
initiator was enhanced through increased testing with its common use in components. 

When possible, the principle of commonality was extended to other assemblies. 
That is, where a new application required an assembly that used a device (or devices) 
in a manner almost identical to the use for which existing devices were originally de- 
signed and tested, the new assembly would be closely related in design and functional 
characteristics. Additional confidence was attained through extensive performance data 
that were compiled for all applications, because the systems were largely dependent on 
component interactions. The policy of standardization of components, which was 
achieved in the Apollo Program to a greater extent than in any other space program, 
was not easy to implement, primarily because of natural tendencies of various prime 
contractors and subcontractors to diverge on the basis of unique technical requirements, 
both real and unreal. 

Where use of the same hardware in different applications was not feasible, the 
same or similar techniques were used. For example, the opposing -blade guillotine, 
which severed the umbilical between the command module (CM) and the service module 
(SM), was used as the basis for the designs of the following: (1) the lunar module (LM) 
interstage guillotine, (2) the two guillotines for umbilicals between the LM and the 
spacecraft/lunar module adapter (SLA), and (3) the landing -gear uplock cutter on the 
LM. 


The quality of explosive materials was very important in the reliability of each 
system. Only newly manufactured, specification -controlled cyclotrimethylenetrinitra- 
mine (RDX) and hexanitrostilbene (HNS) were used to ensure consistent quality and 
traceability of the high-explosive materials. The two types of HNS used, HNS I and 
HNS II, differed in particle size and purity. 
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The need for indexing initiator connectors and for specifying thread direction was 
recognized because of the proximity of the launch-escape cartridges and the tower- 
jettison -motor cartridges. To ensure noninterchangeability of the similarly shaped 
cartridges, an indexing technique — which provided special keyway combinations — 
was developed, and different threads were used on the output ends of the cartridges. 

During manufacture, all critical components were tested nondestructively and 
inspected on a 100 -percent basis. Randomly selected samples of each manufacturing 
lot were expended for functional verification testing at each level of assembly. In addi- 
tion, a representative sample from each lot of devices to be installed on a spacecraft 
was fired at the NASA John F. Kennedy Space Center (KSC) before every flight to en- 
sure that no appreciable deterioration was caused by shipping, handling, or storage 
after original certification of each lot. Standard design practices for satisfactory pro- 
tection against radio -frequency interference (RFI) and other electromagnetic interfer- 
ence (EMI) were followed in the pyrotechnic electrical system. The firing circuitry 
design used twisted firing leads that were completely shielded with no gaps or discon- 
tinuities in the shield. The twisted pairs of firing leads were used to minimize EMI 
problems. The RFI was attenuated by the formation of a Faraday barrier. The Fara- 
day barrier consisted of a shield that was continuous and completely enclosed the firing 
circuitry, including the relays. The pyrotechnic firing system was isolated electrically 
from other electrical systems. Circuit routing was controlled so that the pyrotechnic 
wiring was not near other high -current -carrying circuits. 

Most of the development and test effort described in this report was accomplished 
at the respective plants of the vendors with monitoring and direction from prime con- 
tractor and Government personnel. Because the final decision concerning product ac- 
ceptability was the responsibility of the NASA Manned Spacecraft Center (MSC), limited 
independent testing on a selective basis was conducted at MSC to confirm the validity of 
data from each vendor. Only a brief description of the pyrotechnic components and test 
histories is presented in this report. 


DESCRIPTION OF SYSTEMS 


The Apollo pyrotechnic devices were not recognized or controlled as a single pri- 
mary system but were divided by function among various systems. As parts of the 
spacecraft systems, the devices were broadly classified as follows: (1) launch-escape 
system (LES) components, (2) command and service module (CSM) system components, 
(3) SLA separation system, and (4) LM system components. The general locations of 
the devices are shown in figure 1. Details on the cartridge and detonator assemblies 
and on the core -charge assemblies (mild detonating fuse (MDF), confined detonating 
cord (CDC), linear -shaped charge (LSC), etc. ) are presented in tables I and n. 

A double bridgewire initiator, the Apollo standard initiator (ASI), was originally 
developed and qualified for Apollo use, but the device was unsatisfactory because of 
electrical sensitivity problems. A second initiator, the single bridgewire Apollo stand- 
ard initiator (SBASI) (fig. 2), was developed and qualified as the initiating element for 
all electrically initiated pyrotechnic devices. A primary goal in standardization was to 
accumulate extensive performance data on a single device and, thus, to avoid the devel- 
opment and qualification costs and the time necessary for development of different sys- 
tems with different initiators. Therefore, during development of higher assemblies, 
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Figure 1. - Locations of Apollo pyrotechnic devices. 
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TABLE I. - APOLLO PYROTECHNIC CARTRIDGES 
(a) Pressure and igniter cartridges 


Cartridge 

type 

Cartridge characteristics 

Nominal 

perform- 

ance, 

psi 

Bomb 


Number of 
cartridges 
on each 
spacecraft 

Approximate 
number fired 
after 

Diameter, 

Threads/ 

Type 

Volume 

Type 

Use 


in. 

in. 

in 3 

cc 


qualification 

Pressure cartridges 

Canard 

1-1/2 

12 

Right hand 

13 500 


20 


Closed 

Canard thruster 

2 

500 

Type I 

7/8 

14 

Right hand 

14 500 



52 

Vented 

Drogue parachute 
mortar 

4 

1000 

Type II 

11/16 

12 

Right hand 

11 200 



8.9 

Vented 

Pilot and drag para- 
chute mortar 

8 

2000 

Type IV 

15/16 

16 

Right hand 

2 250 



8.8 

Closed 

CM RCS propellant 
valve 

5 

(a) 

Type IV 

15/16 

16 

Right hand 

2 250 



8.8 

Closed 

SM circuit interrupter 

4 

(a) 

Type IV 

15/16 

16 

Left hand 

2 250 



8.8 

Closed 

CM RCS propellant 
valve 

1 

(a) 

Type VI 

1-1/16 

18 

Right hand 

14 500 


4. 8 


Vented 

Apex -cover thruster 

4 

1000 

Type 100 

11/16 

24 

Right hand 

9 000 



.5 

Closed 

CM and LM RCS 
helium valves 

12 

(b) 

Type 100 

11/16 

24 

Left hand 

9 000 



.5 

Closed 

CM RCS helium valve 

2 

<b) 

Type 200 

3/4 

16 

Left hand 

12 900 



7.0 

Closed 

CM circuit interrupter 

4 

200 

Drogue disk 

13/16 

20 

Right hand 

5 800 


.9 


Closed 

Drogue parachute 
disconnect 

C 2 

300 

Main disk 

1 

16 

Right hand 

10 500 


1.9 


Closed 

Main parachute 
disconnect 

C 3 

400 

LM valve 

3/8 

24 

Left hand 

I 600 



10 

Closed 

LM propulsion system 

22 

300 

Electrical 

circuit 

interrupter 

7/16 

24 

Right hand 

1 000 



10 

Closed 

LM circuit interrupter 

4 

200 

Explosive nut 

9/16 

24 

Right hand 

6 800 



2.7 

Closed 

LM interstage 
separation 

4 

200 

Explosive 

bolt 

1-1/16 

18 

Right hand 

23 000 



2.5 

Closed 

LM interstage system 

4 

200 

SBASI 

3/8 

24 

Right hand 

650 



10 

Closed 

Vent valve and docking 
probe retraction 

4 

(b) 

SLA thruster** 

1-1/16 

18 

Right hand 

4 200 


4 


Closed 

SLA-panel deployment 

8 

600 

Igniter cartridges 

Type I 

5/8 

18 

Right hand 

2 100 



10 

Closed 

Launch -escape/pitch- 
control motors 

4 

(e) 

Type n 

3/4 

16 

Right hand 

2 100 



10 

Closed 

Tower-jettison motor 

2 

(e) 


(b) Detonator cartridges 


Cartridge 

type 

Cartridge characteristics 



Number of 

Approximate 
number fired 
after 

qualification 

Diameter, 

in. 

Threads/ 

in. 

Type 

Nominal performance capability 

Use 

on each 
spacecraft 

Apollo 

standard 

detonator 

9/16 

18 

Right hand 

0.045 -in. dent in aluminum 

Various locations on 
CSM 

26 

(0 

Apollo 

standard 

detonator 

9/16 

18 

Left hand 

.04 5 -in. dent in aluminum 

SLA separation 

2 

(0 

End-type 

detonator 

9/16 

18 

Right hand 

. 018-in. dent in steel 

LM guillotine and 

landing -gear uplocks 

10 

2000 

Long-reach 

detonator 

5/8 

i 

18 

Right hand 

. 022 -in. dent in steel 

Docking ring separation 

2 

300 


a TotaI number of type IV firings is 700. 

b Total number of SBASI firings is approximately 7000. 

C Two S BA Si's per cartridge. 


d Nonelectric cartridge initiated by confined detonating cord. 
e Total number of igniter cartridge firings is 1500. 

*Total number of standard detonator firings is 5000. 
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TABLE H.- APOLLO CORE-CHARGE ASSEMBLIES 


Concentration 
and type of 
explosive 

Sheathing 

material 

Number of 
pieces used 
(a) 

Assembly name 

Linear- shaped charge 

100-grain/ft RDX 

Pb 

2 (6) 

Tension-tie cutter 

Confined detonating cord 

2-grain/ft RDX 

Pb 

i a) 

Lower umbilical guillotine 



i a) 

Ground- support equipment (GSE) umbilical guillotine 

2-grain/ft RDX 

Pb 

2 (2) 

SM/SLA umbilical disconnect 

2-grain/ft RDX 

Pb 

2 (2) 

GSE umbilical guillotine 

3-grain/ft HNS n 

Ag 

2 (2) 

LM guillotine 

Two 5- grain/ft RDX 

Pb 

2 (8) 

SLA panel thruster 

Mild detonating fuse 

Two 20-grain/ft RDX 

Pb 

4 (4) 

CSM umbilical guillotine 

5- grain/ft RDX 

Pb 

2 (2) 

CSM umbilical guillotine 

Two 5- grain/ft RDX 

Pb 

3 (4) 

SLA — forward inside longitudinal 

Two 5- grain/ft RDX 

Pb 

1 (4) 

SLA — forward outside longitudinal 

Two 5- grain/ft RDX 

Pb 

2 (8) 

SLA — aft circumferential 

Two 5-grain/ft RDX 

Pb 

1 (4) 

SLA — lower inside longitudinal 

Two 5 -grain/ft RDX 

Pb 

1 (4) 

SLA — lower outside longitudinal 

Two 5- grain/ft RDX 

Pb 

1 (4) 

Center outside longitudinal 

Two 5- grain/ft RDX 

Pb 

1 (4) 

SLA — center inside longitudinal 

Two 7-grain/ft RDX 

Pb 

1 (4) 

SLA — forward circumferential 

15-grain/ft RDX 

Pb 

2 (2) 

SM/SLA umbilical disk 

Two 10- grain/ft RDX 

Pb 

4 (4) 

Lower umbilical guillotine 

Two 10- grain/ft RDX 

Pb 

4 (4) 

GSE umbilical guillotine 

28. 5-grain/ft HNS II 

Ag 

2 (2) 

LM guillotine 


lumbers in parentheses represent total number of items on a spacecraft. 
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Figure 2. - Single bridgewire Apollo 
standard initiator. 


the explosive train systems were designed 
to be dependent on the proper interaction 
of the standard initiator and on exactly 
matched input and output characteristics . 

The selection of a standard initiator also 

(1) played an important role in the over- 
all reliability of the pyrotechnic systems, 

(2) resulted in shorter development times 
for higher assemblies, and (3) allowed 
demonstration of high reliability at a high 
confidence level for each device. 

The Apollo pyrotechnics configuration 
is shown in figure 3. In some applications, 
the initiator was used alone as a pressure 
cartridge. However, for most applications, 
additional explosive elements or explosive 
trains were assembled to the initiator to 
produce a desired effect. For example, an 
intermediate charge was used in a detonator 
to augment and transfer a detonation wave 
to the main charge of high explosive. Other 
examples are certain types of cartridges for 
pressure generation systems in which an in- 
termediate and an output charge are required. 


Apollo initiator 



- Canard thruster pressure cartridge 

- LM circuit interrupter pressure cartridge ( 

- Drogue parachute mortar pressure cartridge 

- CM circuit interrupter pressure cartridge 

- LM RCS helium valve cartridge 

- LM propulsion system valve cartridge 

- LM interstage separation nut cartridge 

- LM interstage separation bolt cartridge 

- Long-reach detonator for docking ring 

separation charge 

- Docking probe helium bottle valve 

- Docking tunnel pressurization valve 

- Main parachute disconnect cartridge 

- Drogue parachute disconnect cartridge 


Figure 3. - Apollo pyrotechnics configuration. 
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Launch -Escape System 

The LES included the launch-escape motor, the pitch-control motor, the canard 
actuating mechanism, and the tower -jettison motor. The LES was designed to pull the 
CM from the launch vehicle if a pad abort or an abort during first-stage ascent was nec- 
essary. Frangible nuts were used to secure the LES to the CM. To the present, it has 
not been necessary to use the LES for its intended function on any Apollo mission. 

In a nominal flight, the LES is jettisoned after the ignition of the second-stage 
booster (fig. 4). The separation is accomplished by simultaneously igniting the tower- 
jettison motor and the frangible nuts in the base of each tower leg (fig. 5). However, if 
an emergency should occur, the CM would be separated from the launch vehicle immedi- 
ately, and the pitch-control motor would ignite simultaneously with the launch-escape 
motor to provide lateral translation and to assure safety of separation. Eleven seconds 
after LES abort initiation, the canards would deploy to stabilize the system. Three sec- 
onds later, the docking ring would separate from the CM to be jettisoned with the LES. 
The jettison of the apex cover and the deployment of landing parachutes would complete 
the abort sequence. 

Identical igniter cartridges were used in the launch -escape and pitch -control 
rocket -motor igniters; only the thread and connector indexing differed for the tower - 
jettison -motor igniter cartridge. A power cartridge was used to pressurize a thruster 
linkage, which deployed the canards. Detonators were used for fracturing the frangi- 
ble nuts that secured the tower to the CM. 



Figure 4. - Launch -escape -tower Figure 5. - Tower -separation system, 

jettison. 


Command and Service Module Systems 

The CM and SM pyrotechnic devices performed a multitude of tasks in each flight. 
On a typical lunar mission, these tasks began approximately 4 hours into the mission 
with CSM separation from the third stage (S-IVB) of the launch vehicle and were 
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completed a few moments after CM splashdown. The pyrotechnic events accomplished 
during a mission are described in the following paragraphs. 

Separation of the CSM and the SLA. - The SLA connected the CSM to the S-IVB 
until separation. Until then, the LM was contained in the SLA and was secured to the 
lower section by means of four tiedown straps attached to the apex of the four outriggers 
(fig. 6). An explosive train system formed an integral part of the SLA system and was 
used to disengage the four SLA panels on command. The explosive train system con- 
sisted of a number of MDF lines, panel thrusters, an umbilical disconnect, and an um- 
bilical guillotine. The components were interconnected by means of CDC and transfer 
charges. Details of the explosive train system are shown in figure 7. 
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Detonator 


LM fitting 



Connector 


•Tiedown strap 


Tiedown block 


LM tiedown 
adjustment 


SLA separation 
system 


Detail A 
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Explosive train 
chargeholder 
Explosive 
train 

Detonator 
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Chargeholder 
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Panel thruster 
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assembly 
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umbilical 
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SM/SLA electrical 
umbilical disconnect 



-SM bulkhead 


Wire bundle 
Adapter panel 


Detail D 


Figure 7, - Adapter panel explosive 
train system. 


Figure 6. - Lunar module separation 
system. 
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Detonators were fired to initiate the explosive train system, which caused the 
four SLA panels to be jettisoned and permitted separation of the CSM from the S-IVB 
(fig. 8). The MDF was used to sever the forward and aft circumferential and the inner 
and outer longitudinal splice plates of the SLA. The four panels were folded back and 
were jettisoned by means of the cartridge -actuated thrusters. When the splice plate 
was severed, an explosive -operated guillotine severed the umbilical between the LM 
and the SLA. A spring reel then retracted the umbilical arm, which was jettisoned with 
the panel. An explosive charge separated the SM/SLA umbilical disconnect. 



Spring 
thruster 
(4 places)- 

Electrical 
pull -apart 
disconnects 
(8 places) 


Support 

Spring 
thruster 

Upper hinge 
Lower hinge 
Before panel deployment 

Spring 
thruster 

Upper hinge 
Lower hinge 
After panel deployment, 
start of jettison 



(a) Operating details. 


(b) Panel jettison. 


Figure 8. - Separation of SLA panels. 


Separation of the SLA and the LM . - After the CSM separated from the S-IVB, the 
CSM was docked to the LM, and an electrical umbilical was connected to the LM/SLA 
separation firing circuits through the docking tunnel. Detonators in frangible links, 
attached to the four tiedown straps, were fired to permit separation of the LM from 
the SLA. Thirty milliseconds after firing the frangible -link detonators, an explosive 
guillotine was fired to sever the umbilicals for the frangible -link firing circuit. De- 
tails of the LM separation system are shown in figure 6. 

Docking probe retraction . - During docking of the CM to the LM, the docking 
probe (which provided for CM/LM coupling) was retracted by means of SBASI units in 
the probe retraction system. The SBASI, when fired, punctured a gas bottle to release 
gas that drove a piston to retract the probe. 

Docking ring separation . - The LM docking ring separation system was part of the 
CM. The system contained MDF charges that were used to cut the ring and to permit 
final separation of the LM from the CM. During a normal mission, the docking ring 
was separated from the CM and remained with the LM. In the event of a launch emer- 
gency requiring LES abort, the docking ring would have been jettisoned with the launch- 
es cape tower. 
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The CM RCS contained 16 pyrotechnically operated valves, which were used to control 
the distribution of helium and propellants. Each valve (normally closed) was actuated 
by an electrically initiated cartridge. Upon firing, the valves remained open 
permanently. 

Tension ties connecting the SM and the CM (fig. 11) were cut by means of linear- 
shaped charges. The CM/SM guillotine (fig. 12) cut the umbilical between the CM and 
the SM to allow the hinged umbilical boom to swing clear of the CM and permitted sep- 
aration of the CM from the SM. Similar pyrotechnic events would have occurred im- 
mediately upon initiation of an LES abort. 



tie strap 

Figure 11. - Command module and 
service module structural separa- 
tion system. 



Figure 12. - Command module/service 
module guillotine. 


Earth landing system . - The installa- 
tion of earth landing system (ELS) equip- 
ment in the forward compartment of the CM 
is shown in figures 13 and 14. During nor- 
mal entry, the apex cover was jettisoned 
when the spacecraft had descended to ap- 
proximately 24 000 feet. As the cover sep- 
arated from the CM, a lanyard -operated 


switch fired a drag parachute mortar at- 


tached to the cover. When deployed, the 


drag parachute prevented the apex cover 


from recontacting the CM or from inter- 


fering with drogue parachute deployment, 
which followed 2 seconds after cover jetti- 


son. The drogue parachutes were deployed 


in a reefed condition. At line- stretch, the 
time-delay line cutters (fig. 15) were actuated; the line cutters disreefed the drogues 
10 seconds later. At approximately 10 000 feet, the drogue parachutes were released 


by severing the risers with cartridge -actuated guillotines (fig. 16). The main para- 
chutes were deployed in the reefed condition at the same time by means of mortar - 
ejected pilot parachutes. At line-stretch, 6- and 10 -second -time -delay line cutters 


were actuated to effect disreef in two stages. The deployment of the main parachute 
actuated line cutters that, 8 seconds later, automatically deployed two very -high fre- 
quency (vhf) recovery antennas and a recovery beacon from the forward compartment. 
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RCS engine 



Figure 13. - Command module forward 
compartment. 



Figure 15. - Reefing line cutter. 


Immediately after splashdown, the main 
parachutes were released by cartridge - 
actuated blades in the parachute disconnect 
assembly. After touchdown and main para- 
chute release, all pyrotechnic functions 
were completed for the CSM systems. The 
ELS sequence is illustrated in figure 17. 


Forward -heat- shield 
thrust pressure 
cartridges 



Figure 14. - Apex -cover thruster 
locations. 


Note: All risers shown are bundles of steel cables 



Figure 16. - Parachute disconnect 
system. 
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-Apex cover 


1. Apex cover jettisoned at W uKy 

24000 ft + 4 sec W W/- 

2. Drogue parachutes deployed & Vnr 1 

reefed at 24 000 ft + 2 sec V ( 

3. Drogue parachute single-stage ^ >_. 

disreef, 10 sec \ 

4. Main parachute deployed reefed by way of pilot parachutes, 

and drogue parachutes released at 10 000 ft 

5. Main parachute initial inflation 

6. Main parachute first-stage disreef, 6 sec 

7 . vhf recovery antennas and flashing beacon 

deployed, 8 sec 

8. Main parachute second-stage disreef, 10 sec 

9. Main parachutes released 


Figure 17. - Earth landing sequence. 


RCS helium Ascent propulsion 

ED control panel isolation valves compatibility valves 



Descent propulsion Landing gear ED relay box 12) 

helium isolation valve uplock (descent/ascent 

(4 places) stage) 


Note: ED ■ explosive devices 


Lunar Module Systems 

The LM pyrotechnic devices and 
systems were used for deployment of the 
landing gear; for opening of valves for pres- 
surization of the descent, ascent, and RCS 
propellant tanks; for venting of descent pro- 
pellant tanks; for electrical circuit inter- 
ruption; for interstage umbilical severance; 
and for separation of the ascent and descent 
stages. The' general locations of the LM 
pyrotechnic devices are shown in figure 18. 

Landing -gear operation . - The LM 
landing gear was retracted during trans- 
lunar flight. Before separation of the LM 
from the CSM, detonators in the uplock 
devices (fig. 19) were fired to drive a blade 
that severed the strap and permitted springs 
in the deployment mechanism to extend the 
landing gear. The design of the landing - 
gear uplock device included two opposing 
blades to sever the holding strap. Before a 
problem that was uncovered during qualifi- 
cation testing, both blades were driven 
simultaneously by firing both detonators at 
the same time. The problem was that this 
procedure sometimes resulted in the strap 
being "captured” between the two blades and, 



Figure 18. - Lunar module pyrotechnics. Figure 19. - Lunar module landing -gear 

uplock and cutter assembly. 
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because of simultaneous firing, caused the blades to meet at the center of travel and 
deflect one another. Capture of the strap could prevent landing-gear release. The 
reliability of a single blade severing the strap already had been demonstrated. There- 
fore, the sequence of firing the detonator for each blade was staggered to eliminate the 
probability of capture of the strap. The second blade acts as a backup if the first blade 
malfunctions. Otherwise, the second system is fired only to eliminate the live 
detonator . 

Pressurization valves . - When opened, pyrotechnically actuated valves installed 
in the LM propulsion systems allowed descent propellant tank pressurization and vent- 
ing, ascent propellant tank pressurization, and RCS propellant tank pressurization. 

The valves operated instantaneously upon command by firing self-contained explosive 
charges, which provided the necessary impulse for valve functioning. The valves nor- 
mally were closed to provide complete shutoff of flow, and, after actuation, valves 
were opened permanently. The configuration of the valves was similar to the valve 
shown in figure 10. Helium -isolation valves, fuel and oxidizer valves, and vent valves 
were the pyrotechnically operated valves in the descent propulsion system. The ascent 
propulsion system contained helium-isolation valves and fuel and oxidizer compatibility 
valves. Helium -pressurization valves were used in the RCS. Electrically initiated 
explosive cartridges were used for actuation. 

Separation of ascent stage . - Four explosive nuts and bolts were used in the inter- 
stage structural connections, and an interstage umbilical cutter was used to sever the 
interstage electrical umbilical. The separation of the ascent and descent stages in- 
volved the following steps: (1) operation of the circuit interrupter (fig. 20) to break 
the interstage electrical circuits, (2) separation of the interstage nuts and bolts 
(fig. 21), and (3) severance of the umbilical by the interstage umbilical guillotine 
(fig. 22). 



Figure 20.- Lunar module electrical 
circuit interrupter. 
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COMPONENT DESIGN AND DEVELOPMENT 


The pyrotechnic devices were of prime importance for flight safety. The safety 
design reliability goal was established to be 0.9999 at the 95 -percent confidence level. 
The demonstration of such reliability was impractical by direct testing methods (because 
it would have required demonstration of no more than one failure in approximately 
45 000 firings); however, statistical test methods were used to obtain data upon which 
acceptable estimates could be made. Under conditions simulating the complete mission 
profile (including launch, spaceflight, and recovery), abbreviated test programs were 
conducted to determine that each device tested was functionally safe and reliable. 

Tests of the initiators were performed in all applicable types of environment and 
storage conditions to obtain information on the safety aspects or the no -fire capabilities 
of a particular device. Sensitivity and output tests were conducted to determine the 
capabilities of the initiators (1) as separate components and as integral parts of other 
devices and (2) as parts of complete systems. Test fixtures and conditions simulated 
the intended applications that incorporated the electrical input sources and characteris- 
tics and the output characteristics. Physical and environmental surroundings were 
simulated to assess functional capabilities arid requirements. 

The performance evaluation of each device consisted mainly of obtaining informa- 
tion on input and output characteristics. In general, testing of input characteristics 
consisted of sensitivity measurements to determine energy requirements for satisfac- 
tory firing of the device. Testing of output characteristics consisted of obtaining data 
on the physical phenomena that resulted from the firing of the device. For example, 
during the performance evaluation of the SBASI, sufficient data were obtained to predict 
the true all -fire and no -fire current levels for particular functioning times. Another 
example is the reefing line cutter, for which tests were conducted to determine, at vari- 
ous pull angles, the pull force required to trigger the ignition system for satisfactory 
performance. Also, the reefing line cutter was tested at different temperatures to ob- 
tain curves of the shift in functioning times. 

Depending on the circumstances, tests to determine the hazards associated with 
the pyrotechnic devices required special test procedures and equipment. Because most 
pyrotechnic devices were initiated electrically and normally would not discriminate be- 
tween sources of ignition energy, tests were conducted under various conditions with a 
range of electrical sources of energy. Test hardware also was subjected to miscella- 
neous tests that cannot be considered input, output, or electrical hazards tests, but were 
performed to observe and resolve the effects of different conditions on the devices. 
Surveillance tests, sealing and moisture -proofing tests, and vibration and shock tests 
were included in the development program. 

The types of inspection and nondestructive tests common to all units included vis- 
ual and X-ray examination of the product, bridgewire and insulation resistance tests, 
leakage tests, and neutron radiographic (N-ray) inspections. However, N-ray inspec- 
tions were not performed on the initiators. 

Neutron radiography is a relatively new technique. In a number of instances, 
such as examining the explosive core in an MDF for discontinuities, the N-ray technique 
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was superior to X-ray. The opacity of the lead sheath and of the explosive core to ther- 
mal neutrons is the reverse of that with X-rays; however, the advantage was lost when 
the MDFwas bonded into a chargeholder with a hydrogenous material such as epoxy. 
Therefore, the N-ray technique was applied only selectively to Apollo pyrotechnics to 
supplement X-ray examination. 

Over the past 6 years, all Apollo pyrotechnic devices and systems have been 
tested extensively on the ground, in unmanned flights, and in manned flights. The 
following is a summary of the evolution of the components and accumulated history from 
all test programs conducted before the Apollo 13 mission. 


Single Bridgewire Apollo Standard Initiator 

As stated earlier, a double bridgewire initiator, the ASI, originally was developed 
for use in the Apollo Program but was replaced by the single bridgewire initiator, the 
SBASI. More than 20 000 ASI units were tested or used satisfactorily during the space- 
craft development program. Approximately 7000 SBASI units have been tested and used 
since. Approximately 140 initiators were installed for each Apollo mission. The ASI 
units were used in all Block I Apollo spacecraft, except for the vehicles used for the 
Apollo 4 and 6 missions, in which both ASI and SBASI units were used. All Block II 
Apollo spacecraft were equipped with SBASI units. 

Except for having only one bridgewire, the SBASI was identical physically to the 
dual -bridge ASI. The modification to a single bridgewire unit was made primarily be- 
cause of electrical sensitivity problems associated with the bridgewire -to -bridgewire 
mode. In addition to low interbridge electrical resistance, occasional, inadvertent 
firings were attributed to buildup and discharge of accumulated electrostatic charges. 
Other recorded data showed that a difference of approximately a 50-volt potential be- 
tween the bridgewires would cause degradation of the primary charge. The built-in 
spark gap was not intended to protect against ignition from spurious forms of stray 
electrical energy in the bridgewire -to -bridgewire mode. 

The design of the SBASI retained the performance and desirable electrical char- 
acteristics of the original ASI and incorporated the following changes. 

1. To improve the impact resistance at temperatures below -65° F, the body 
material was changed from type 17-4 PH steel to Inconel 718. 

2. To increase internal pressure capability, the wall thickness surrounding the 
charge cup was increased, the shape of the header was modified, and the header was 
welded to the body. 

3. To ensure that the pins would remain securely fixed under high internal pres- 
sures, the header material was changed from ceramic to Inconel 718, and the pins were 
glassed to the header instead of being brazed to a plating material coating the ceramic. 

4. To protect against environmental contamination (i. e. , humidity, air density 
changes, and dust particles), the spark gap location was changed to the interior of the 
unit. The spark gap was required to prevent inadvertent firing from extraneous high- 
voltage discharges by diverting discharge to ground. 
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A design deficiency that remained with the SBASI involved the built-in spark gap 
and was associated with the breakdown of insulation resistance. Contamination could 
be unintentionally introduced in the spark gap during manufacturing operations, and 
some units were rejected because of insulation resistance failure. However, units 
exhibiting resistance failure were rejected on an individual basis. 

During development of the SBASI, the body -header assembly was tested hydro- 
statically after repeated thermal shocks, ranging from -320° to 500° F, to over 
100 000 psi without failure. During production, all units were tested to 40 000 psi. 

All production units also were tested for electrostatic survival capability to withstand 
25 000 volts (from pin to case) and were leak tested with helium to ensure proper her- 
metic sealing. The ASI and SBASI units produced by the two manufacturers were tested 
extensively to ensure complete interchangeability. Sectioned and exploded views of the 
SBASI are shown in figure 2. 

Indexing the connector end of the SBASI after manufacture permitted manufacture 
and stocking of a standard unit. Indexing of the units was accomplished as needed by 
staking the barrels to meet a specific keyway combination (fig. 23). Nine special key- 
way combinations were used to meet special requirements. 

Staking was accomplished by blocking 
keyways. The keyways were blocked by 
crimping the outer lip of the keyway inward 
to a dimension that prevented the mating 
connector key from entering the slot. After 
qualification of the staking procedure, it was 
found that improper crimps could result 
from the use of worn crimping tools. The 
resultant improper staking in the electrical 
connector portion of the SBASI allowed a 
mating electrical plug of different key con- 
figuration to be connected. 

To prevent the use of crimping tools 
worn beyond dimensional tolerances, man- 
datory dimensional checks of the crimping 
tool were established. Dimensional checks 
also were established on the initiator itself 
and were verified by using a comparator for 
acceptance inspection. 


Keyway 

numbers- 

Master 

keyway— J 

00000000045. 

4 3 

XXI XX2 XX3 XX4 XX5 XX6 XX7 XX8 XX9 (XXO) 


Basic part Dash 
number number 

Designation 

SEB26100001 - 1XX 

Prototype, developmental experimental 

SEB26100001 - 2XX 

Flight configuration, qualified or 
qualifiable 

SEB26100001 - 8XX 

Inert device 

SEB 26100001 - XIX 

Weld washer attached 

SEB 26100001 - X5X 

No weld washer 

SEB26100001 - XXI 

Keyways 1 and 6 closed (nonflight) 

SEB26100001 - XX2 

Keyways 2 and 6 closed (flight) 

SEB26100001 - XX3 

Keyways 3 and 6 closed (flight) 

SEB26100001 - XX4 

Keyways 4 and 6 closed (flight) 

SEB26100001 - XX5 

Keyways 5 and 6 closed (flight) 

SEB 26100001 - XX6 

Keyways 1 and 2 closed (flight) 

SEB26100001 - XX7 

Keyways 1 and 3 closed (flight) 

SEB26100001 - XX8 

Keyways 1 and 4 closed (flight) 

S EB 26100001 - XX9 

Keyways 1 and 5 closed (flight) 

SEB26100001 - XXO 

All keyways open (required specific 
MSC authority for use) 


Figure 23. - Initiator indexing. 
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Cartridge Assemblies 

Cartridges of various sizes and configuration were used in the following applica- 
tions: (1) actuation of electrical circuit interrupters and disconnects, (2) operation of 
thrusters, (3) deployment of parachutes, (4) operation of valves, and (5) as component 
parts of separation systems. Most cartridges were similar in construction, but dif- 
fered in thread size and type and in amount of output charge. Figure 24 is a sketch of 
a typical electrically initiated cartridge assembly. Figure 25 is a photograph of the 
various cartridges, including detonator cartridges. 



Figure 24. - Electrically initiated 
cartridge. 





Figure 25. - Spacecraft cartridges. 


All but one type of cartridge were initiated electrically by an SBASI. The only 
nonelectric cartridge (fig. 26) was initiated by CDC and was used to operate the SLA- 
panel thrusters. By adding booster modules containing various charges, special pur- 
pose cartridges were obtained. The physical configuration, performance, and uses of 
all cartridge and detonator assemblies are listed in table I. The SBASI is included in 
table I because the unit was used alone as a pressure cartridge in the docking probe 
retraction system and in the docking tunnel vent valve. The indexing of the SBASI in 
the cartridges is shown in figure 23. Cartridges with different outputs had different 
threads to prevent improper installation. Cartridges with the same output, but located 
close to each other in the spacecraft and fired at different times, were indexed differ- 
ently. Thus, the same thread and indexing could be used in various locations on the 
spacecraft. 

Each cartridge assembly (except the SLA -panel thruster cartridge, which was 
fired by CDC) consisted of one or two SBASI units hermetically sealed to a cartridge 
body by a weld washer. The weld washer is shown in figure 27. The type 100 pressure 
cartridge contained no charge other than that in the SBASI; the cartridge module was 
an adapter necessary to install the SBASI in a small explosive valve. Approximately 
250 units of each type of cartridge assembly were fired during qualification test 
programs. 
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Figure 26. - Spacecraft/lunar module Figure 27. - Initiator with weld washer, 

adapter thruster cartridge. 


Detonators 

Three types of detonator cartridges were used. The Apollo standard detonator 
(ASD) (fig. 28) was used in the following locations: the tower -separation frangible nut, 
the CM/SM guillotine, the tension-tie cutter, and the lower LM guillotine. The ASD 
was used for SLA -panel separation and for LM/SLA separation. The ASD also was 
used to initiate up to 20 grains/ft of MDF or 100 grains/ft of LSC. The ASD consisted 
of a modular assembly of the initiator with a primer, an intermediate charge of lead 
azide, and an output charge of RDX. 



(a) Detonator cartridge assembly. (b) Cross section. 

Figure 28. - Apollo standard detonator. 
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The end-detonating cartridge (EDC) 
was developed for high-temperature appli- 
cations where a directional shock was re- 
quired for the initiation of high-explosive 
elements. The EDC had a heavy wall 
thickness along the threaded length of the 
output end (fig. 29) . The EDC was used on 
the LM guillotine and on the landing-gear 
uplock. The EDC had an intermediate 
charge of lead azide and an output charge 
of HNS. 

The long-reach detonator (LRD) 

(fig. 30) was used in the docking ring' as- 
sembly only. The configuration was nec- 
essary to extend the output charge to an 
interface area that was inaccessible with 
either the ASD or the EDC. The LRD had 
an intermediate charge of lead azide and 
an output charge of HNS. 

A significant problem, which was 
relevant to lack of manufacturing control 
rather than to design, arose on July 30, 
1969. Two of four detonators tested in LM 
guillotine lot acceptance tests failed to 
fire high order. Results of the failure an- 
alysis showed that the failures were 
caused by alcohol contamination and that 
this contamination apparently was isolated 
to only one lot of detonators. This con- 
tamination was confirmed by both N-ray 
inspection and mass spectrometric analy- 
sis. Spectrometric analysis of one suspect 
unit showed it to have an alcohol content of 
18. 3 microliters. Further investigation in- 
dicated that the threshold could be below 
6. 75 microliters and that the N-ray tech- 
nique could not be used alone to determine 
whether units contain alcohol at this level. 

In addition to the requirement that 
no alcohols or solvents be permitted in 
loading rooms, corrective action required 
that two units from each lot be selected at 
random for mass spectrometric analysis. 
Total volatiles, excluding water, could 
not exceed 0. 040 microliter per unit. 

This value was arrived at by sampling a 
normal lot of detonators and determining 
the level of contamination, which turned 
out to be 0. 02 to 0. 03 microliter. 



Figure 29. - End-detonating 
cartridge. 



Figure 30. - Long- reach detonator. 
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Core Charges 


Three types of core charges were used (fig. 31). An LSC was used to sever the 
tension ties connecting the SM and the CM. An MDF was used to sever the forward 
and aft circumferential and the inner and outer longitudinal splice plates of the SLA 
and for separation of the docking ring from the CM. The MDF also was used as the 
explosive element in the guillotines for driving the blade that cut the umbilicals. A 
CDC was used for detonation transfer between various points in the SLA separation 
system. Core- charge assemblies and their uses are listed in table II. 



(c) Linear-shaped charge. 
Figure 31. - Core charges. 


The principal explosive used as the core explosive was RDX; however, in the 
CM-to-LM docking tunnel and in the LM interstage guillotine, where temperature re- 
quirements were more severe, a heat- and vacuum- resistant explosive (HNS) was used. 
In most applications, booster charges containing lead azide were attached to both ends 
of the linear charge to ensure detonation transfer. In the SLA, in addition to the 
boosters on the ends of the linear charge, separate boosters were employed for addi- 
tional assurance of reliable detonation transfer. 
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Approximately 100 separate explosive train assemblies incorporating linear 
charges were installed on each spacecraft. The assemblies were developed during 
qualification of the components containing linear charges . More than 2500 feet of linear 
charges were tested satisfactorily during component qualification. 

Problems related to the use of core charges that occurred during the Apollo Pro- 
gram include the following. 

Tension-tie cutter. - The tension- tie -cutter core charge consisted of an LSC of 
100- grain/ft RDX in lead sheath. Boosters were attached to the ends to effect reliable 
detonation transfer from detonator to cord. During the thermal vacuum exposure por- 
tion of the qualification program, blistering of the booster charges and bulging of the 
V-angles to out-of-specification values occurred after exposure to a temperature of 
120° F for 72 hours. This phenomenon had been anticipated during development because 
knowledge existed concerning similar problems in other military and space programs; 
however, because the expected blistering or bulging did not occur during the develop- 
ment program, no measures were taken in the design of the system to ensure structural 
integrity when exposed to elevated temperatures . 

After the anomaly occurred, a program was conducted to determine whether deg- 
radation had occurred as a result of impurities in the explosives or if other sources of 
contamination were responsible for the bulging and blistering. Results of analyses 
indicated that no degradation of the explosive products had occurred and that no contam- 
inant was introduced into the system to cause the angle change or the blistering. All 
tests conducted to determine the reason for angle change and blistering proved incon- 
clusive. However, tests conducted on "worst parts" showed breakage of 120-percent 
plates. 

Lack of positive information concerning bulging and blistering was sufficient 
justification for modifying the design, even though it had been demonstrated that even 
"worst case" units were capable of severing the ties. The material for end caps, which 
originally were made of preformed lead soldered to the LSC, was changed to aluminum 
with epoxy adhesive for mating to the LSC. This change in design eliminated the proba- 
bility of blistered end caps. To control V-angle bulging, the boostered LSC's were 
inspected and selected only after being subjected to a series of temperature screening 
cycles; the acceptance criterion specified that all charges selected maintain a 96° ± 2° 
angle during and after exposure to all temperature cycles. 

Spacecraft/LM adapter . - The SLA core charges consisted of MDF’s of 5- and 
7 -grain/ft RDX in lead sheath. During disassembly of charges from the chargeholders 
in tests conducted at MSC , severe degradation of the lead sheath was observed for that 
portion of the MDF in contact with the RTV adhesive used for bonding the charge to the 
holder . 
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Several samples of the same lots of material (ranging in age from 3. 5 to 5 years) 
had unacceptably low detonation velocities . The change in detonation velocity from an 
average of 6500 m/sec to as low as 5300 m/sec was attributed to the degradation of the 
sheath material. As a result of degradation, the lead sheath no longer confined the 
explosive core to the extent required for satisfactory functioning. 

Adhesive RTV 30-121 was used to bond the cords in place. Acetic acid is an 
intermediate product during curing of the RTV adhesive. Results of metallurgical 
analyses conducted on degraded MDF lead- sheath samples indicated that the product of 
interaction of the acetic acid with the lead sheath was responsible for degradation of 
the sheath. As a result, all SLA core-charge assemblies were ’’recalled”; the RTV 
30-121 adhesive and explosive cord were removed from the chargeholders and replaced 
with new MDF lines potted in place with RTV 577 adhesive. Tests were conducted to 
demonstrate the compatibility of RTV 577 adhesive with the lead sheath. 

Docking ring separation system . - The docking ring separation system core 
charge consisted of two strands of 6-grain/ft HNS-MDF in silver sheath. Adhesive 
RTV 30-121 was used for potting the MDF in the chargeholder. On December 8, 1971, 
during verification tests to check capability for single-cord functioning, a failure to 
completely sever the docking ring occurred. As a result, the design of the docking 
ring separation system and its redundancy capabilities were investigated. 

, Results of design analysis indicated that as much as 0. 006 square inch in cross- 
sectional-area free volume (approximately the same volume as that occupied by the 
cord) could exist with improper potting of the RTV adhesive in the chargeholder groove. 
Tests conducted to determine the effect of change in cord location relative to the amount 
of free volume resulted in the determination that lack of adequate confinement could 
result in incoifiplete separation of the docking ring separation system. 

To eliminate the possibility of inadequate confinement, a procedure was developed 
for the buildup and installation. The RTV adhesive was applied in three different stages 
to ensure that no voids remained in the chargeholder groove after potting of the charge- 
holder was complete. Special tooling and jigs were developed to locate and control the 
cord and the RTV adhesive to within critical dimensions. Several full system tests 
demonstrated single-cord capability and redundancy after using the new installation 
procedure. 


Line Cutters 

Time-delay line cutters (fig. 15) were used for deployment of recovery aids and 
for cutting of parachute reefing lines. Eight 10-second time-delay cutters were used 
on the drogue parachutes. Twelve 6-second and six 10-second time-delay cutters were 
used on the main parachutes for disreefing in two stages. A total of six 8-second time- 
delay cutters were used to deploy vhf and high-frequency antennas and the recovery 
beacon. More than 1000 units were fired satisfactorily in tests and during flights. 

Another example of a problem relevant to a lack of quality and manufacturing 
control was an anomaly that occurred on October 1, 1971, when, during lot acceptance 
test firing, a ’’spit of flame” of a few milliseconds duration was observed coming from 
the hole of the firing pin retainer of one unit. An X-ray examination revealed that the 
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anomaly occurred because of primer header assembly blowback during ignition and 
that the phenomenon actually had occurred on other units as well, although previous 
occurrences were not observed visually. Review of X-rays taken of the entire lot 
before functioning revealed that the general quality of manufacture, assembly, and in- 
spection were far below par. 

As a result of analyses conducted, the following determinations were made. 

1. A new lot of M42 primers was used in the assembly of the cutters. Until 
then, a single lot of primers had been used in the assembly of all cutters. 

2. Because of the difference in output of the new lot of primers, a change in 
delay column height was made to accommodate the change in primer output pressure. 

3. The change in primers and in delay column height resulted in stackup of 
tolerances, which was cause for a less than satisfactory crimp of critical interfaces. 

Although all requirements for function time, reefing line severance, and required 
pull force for initiation were met, the lot was rejected because of the header blowback 
anomaly, attributed to the substandard quality of workmanship coupled with the higher 
pressure output of the primer. Better quality control measures for correction of the 
problem included conducting appropriate tests for making determinations upon which 
criteria would be based for the use of certain primers in specific applications. 


GROUND-SUPPORT EQUIPMENT 


Ground -support equipment (GSE) was used to service and check out spacecraft 
systems before flight. The pyrotechnic checkout equipment included pyrotechnic simu- 
lators and spacecraft verification equipment. 


Pyrotechnic Simulators 

The CSM initiator simulator . - The CSM initiator simulator was an electrome- 
chanical device used in lieu of actual hot bridgewire initiators during systems and 
integrated tests of the CM and the SM. The device (fig. 32) was a suitcase -type 
enclosure that housed six bridgewire simulator circuits. Each circuit was composed 
of relays, diodes, fixed and variable resistors, and test jacks in a combined network 
and was joined to external connectors (fig. 33). The unit was portable and was designed 
to be ignition -proof for use in hazardous areas. The case assembly was constructed 
with a fill valve to pressurize the case with an inert gas for ignition -proofing purposes. 
The case measured 12 by 10 by 7 inches and weighed 20 pounds. The power require- 
ments were 28 volts direct current (dc) at 0. 7 ampere. 

The unit contained six circuits capable of substituting electrically for six pyro- 
technic initiator bridgewires and provided a simulated result of initiator bridgewire 
action. The input resistance to each simulator was 1 ohm, which became an open cir- 
cuit to simulate bridgewire burnout while protecting spacecraft circuitry from over- 
current drain. All units were capable of being reset remotely. Signal input originated 
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and was controlled by the spacecraft sequencers. The input was detectable by each 
subcircuit in three modes: an all-fire condition, positive and negative transient condi- 
tions, and a no-fire condition. Output signals from the device were transmitted through 
an interface junction, the initiator stimuli unit, to the acceptance checkout equipment 
(ACE) consoles, which provided discrete light indications. A transient output signal 
of 6 volts dc was generated when a signal input voltage was greater than 0.17 volt 
(positive or negative polarity) but was of insufficient magnitude to initiate a "go” output 
signal. The go output signal voltage was also 6 volts dc when an input current level of 
5 amperes or greater was applied for 10 milliseconds. The 6-volt output signals 
eventually controlled the go/no-go lamps on the ACE console. 

Many problems occurred during the evolution of the unit. Examples of such 
problems are listed here to point out areas where special attention should be given on 
any future work. 

1. The simulator must provide a 1-ohm load to the spacecraft circuitry and 
must become an open circuit after a specified current pulse has been received. If the 
device failed to become an open circuit, the spacecraft circuitry would be damaged by 
extended current drain. The circuitry was damaged on three spacecraft because the 
original design required facility power to operate the circuit- opening relay. In each 
case, the damage was caused by a loss of facility power. The present Apollo design 
includes fail-safe requirements and redundant circuit-opening features. The fail-safe 
requirement was met by a relay circuit design that required facility power to complete 
the 1-ohm spacecraft load. Loss of facility power would result in an open-circuit load, 
which would protect the vehicle circuits. Redundant circuit opening was accomplished 
by using two separate relays with contacts wired in series so that failure of a relay 
would still allow the 1-ohm load to become an open circuit in the specified time and, 
thus, prevent damage to the spacecraft circuit. 

2. The devices, as originally designed, gave false no-go indications because 
the open circuit did not occur as fast as required. Even though the lag did not damage 
spacecraft wiring, overlapping of the time- sequenced functions resulted in higher than 
normal loads on the spacecraft circuitry. To correct this problem, a relay and ca- 
pacitor combination that would open at the proper time sequence to prevent overlapping 
of functions was added in series with the 1-ohm load circuit. 

3. In one early design, current flow was significantly longer than planned. This 
situation occurred because transient actuation did not result in the simulation of an 
open circuit when the spacecraft bus voltage was low. With no open circuit, the space- 
craft circuitry could be damaged. To correct this problem, the transient detecting 
relay was wired so that either it or the go relay could open the circuit. 

4. The time response of the transient detector was not fast enough for detection 
of short -duration pulses. With very high current levels of very short duration, the 
initiator actually could be fired without detection of a current pulse by the simulator. 

The fast response time could not be obtained by using relays. A change to solid-state 
detection would not have supported the schedule for the CSM; therefore, a ’’workaround” 
procedure that consisted of monitoring the 1-ohm load resistance with an oscilloscope 
was used. 
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The LM initiator simulator . - The LM initiator simulator (fig. 34) was a portable 
unit used to check out the function of electrical systems by simulating the electrical 
characteristics of the initiator. The simulator also was capable of detecting transients 
or interference signals at the initiator connector. 


The equipment consisted of 40 circuit -monitor modules having dimensions of 
5 by 3 by 3 inches. Each module weighed approximately 2 pounds and was hermetically 
sealed. The modules were stored in a carrying case capable of accommodating 
45 modules. The carrying case was a suitcase -type enclosure with dimensions of 
30 by 30 by 30 inches and weighed 10 pounds. The power requirements were 28 volts 
dc at 9. 0 amperes. 


Approximately 34 individual simulators- 



Figure 34. - Functional block diagram 
of LM initiator simulator. 


Each module provided a 1 -ohm input 
to simulate the bridgewire resistance of 
each initiator. The 1-ohm input became an 
open circuit after receiving either an all- 
fire or a transient signal; a current of 
7. 5 amperes or greater resulted in a go 
indication; and a 200-milliampere or 
greater current, with a duration of 5 micro- 
seconds or longer, would result in a tran- 
sient indication. The output signals were 
processed through the ACE to the go and 
transient lamps located on ACE consoles. 
Solid-state electronic devices were used 
in each module to obtain the faster response 
times. 


The first design was a solid-state 
device but had three major undesirable 
characteristics: (1) The unit did not have 
redundant capability to obtain an open cir- 
cuit after firing and, thus, prevent damage 
to spacecraft firing circuits. The redun- 
dancy was accomplished later by providing 
series redundant relay contacts actuated by 
both the go and transient circuits. (2) Use 
of a common power supply without isolation 
between modules caused sneak circuits and 
ground loops that resulted in false output 
indications. These problems were solved 
by providing isolation resistors between 
each simulator module and the power sup- 
ply. (3) The unit could be actuated pre- 
maturely by EMI. This problem was 
solved by incorporation of EMI filters in the 
power supply input circuit and by the use of 
shielded cables on all input and output leads. 
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The environmental initiator simulator . - The environmental initiator simulator 
(fig. 35) was developed for use during vacuum -chamber testing of the spacecraft. The 
device was an inert SBASI with a normal bridgewire. Each device was hermetically 
sealed for operation in an environment containing hazardous propellant gases. The 
initiator was sealed by welding the unit into a stainless-steel block; thus, inadvertent 
installation of an inert unit in a flight vehicle was prevented. Seventy-five of the inert 
devices were packaged in a portable carrying case. 

The inert SBASI provided an exact electrical simulation of the flight initiator be- 
cause a flight-type bridgewire was used. When a sufficient spacecraft firing current 
was received, the bridgewire was burned and an open circuit resulted. Because no ex- 
ternal output indicators were used, each device had to be inspected with an ohmmeter 
after spacecraft testing was completed. 



The static EMI device . - The static 
EMI device was developed for use during 
one of the spacecraft systems verification 
tests in which the GSE was not connected 
to the spacecraft (plugs out) . The device 
was used for passive monitoring of the 
ordnance electrical system to ensure that 
interference from other systems would not 
affect the ordnance undesirably. A 
l/16-ampere fuse in the device was mated 
directly with spacecraft wiring. 


Figure 35. - Environmental initiator 
simulator. 



Each device (fig. 36) was contained 
in a cylindrical module 2- 3/ 4 inches long 
with a diameter of 1 inch. The device had 
a spacecraft mating connector on one end 
and a fuseholder on the other end. The de- 
vices were transported and stored in a 
portable container having a capacity of 
43 units. Because the unit had no external 
read-out capability, an ohmmeter inspection 
had to be made after the plugs-out testing 
was completed. The device was not her- 
metically sealed and could be used only 
for ambient environmental testing. 


Figure 36. - Static EMI device. 


During use in the Apollo Program, 
two problems were encountered. Some of 
the units were found to have actuated pre- 


maturely, and others failed to actuate when exposed to sufficient actuation current. In- 


vestigation showed that the units were actuated prematurely during checkout by the use 


of a non-current-limiting ohmmeter. The output current was sufficient to actuate the 
unit. This problem was corrected by requiring the use of current-limiting ohmmeters. 
Investigation of the units that failed to actuate showed that the problem was caused by 
use of improper fuses. The module required plug-in-type fuses. Some of the fuses 
used were of the pigtail type, which had longer leads. These leads were cut to the 
approximate length of the plug-in type. Cutting the leads resulted in a flattened pin, 
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which caused improper contact with the fuseholder. This problem was corrected by 
requiring the use of proper fuses. 

The stray electrical energy indicator . - The stray electrical energy indicator was 
used to simulate the electrical characteristics of the initiator while detecting excessive 
levels of RFI on the ordnance electrical system of the spacecraft. The stray electrical 
energy indicators were installed in lieu of flight initiators on the totally stacked vehicle 
at the launch pad. All onboard and ground radio -frequency (rf) emitters were energized 
to verify RFI compatibility. 

The stray electrical energy indicator (fig. 37) consisted of a special SBASI that 
was screwed into an adapter. The unit was 3 inches long with a diameter of 1 inch. 

The indicator consisted of a bellows that expanded to give visual indication of unit actu- 
ation. The special SBASI contained a more sensitive bridgewire (higher resistance) 
and an rf -sensitive ignition explosive. The unit was hermetically sealed, even after 
firing. When the initiator was fired, the plunger in the indicator was forced outward to 
expand the metal indicator bellows. The unit connector had all keyways left open so 
that the unit could mate directly with any spacecraft ordnance connector. 

Considerable effort was expended in the development of an acceptable RFI detector 
because of the problem of obtaining a proper impedance simulation across the frequency 
spectrum. The use of an actual explosive device was the only solution. 

The high -energy -initiator simulator . - 
The high -energy -initiator simulator, also a 
device to simulate the initiator during 
ground testing, presented the spacecraft 
with electrical characteristics similar to 
the SBASI. This unit was used during check- 
out of all flight vehicles at KSC, including 
both the CSM and the LM. The device was 
used during performance of simulated mis- 
sions, including the altitude -chamber runs. 

A visual indication of status was required 
without an interface with the chamber wiring. 
This requirement, along with the high cost of 
the environmental simulator, prevented use 
of either the LM initiator simulator or the 
environmental simulator, described earlier, 
in this application. Each high -energy - 
initiator simulator (fig. 38) was 3 inches 
long with a diameter of 0. 75 inch and weighed 
less than one -quarter pound. The device 
was hermetically sealed and could be used 
in vacuum -chamber testing and in hazardous 
gas areas. The carrying case was capable 
of accommodating 100 units. The device was 
mated directly with the spacecraft initiator 
connector and provided a resistance of 
1. 05 ohms before firing. When the device 
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received a firing current, an open circuit resulted within a time interval that was 
dependent upon the current level through it. 

The device consisted of a fuse in series with a 1-ohm resistor; a second resistor 
and a photoflash bulb were in parallel with the series circuit. The second resistor was 
adjusted to a value that caused the bulb to flash when the required firing current level 
was reached. Temperature -sensitive paper was placed around the bulb to provide a 
visual indication that either an all-fire or a no-fire current level was reached. 

The only failures with the device involved flashbulbs that did not function. Space- 
craft system failures were distinguished from bulb failures by verifying that the simu- 
lated bridgewire (fuse and resistor) was in an open-circuit condition after tests. Upon 
consulting the flashbulb manufacturer, it was determined that the incidence of failure 
was well within that to be expected and no reasonable corrective action could be taken. 


Spacecraft Verification Equipment 

The pyrotechnic checkout test set . - The pyrotechnic checkout test set was a port- 
able, self-contained unit that was used for the following; (1) to detect and measure 
stray voltages in the spacecraft pyrotechnic circuits, (2) to measure resistance and to 
verify continuity of these circuits, and (3) to measure the resistance of the installed 
pyrotechnic initiators. The test set (fig. 39), which was approximately 11 by 8 by 8 in- 
ches in size, had carrying handles and a removable top cover. Included with the test 
set were 20 dummy initiators that were integrated with the pyrotechnic circuitry in 
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Figure 39. - Pyrotechnic checkout test set. 


place of actual pyrotechnic initiators. The test set and dummy initiators weighed 
approximately 30 pounds. The test set was used to verify the pyrotechnic circuits 
before, during, and after installation in the spacecraft. 

The bridge circuit consisted of a resistance bridge of the Wheatstone type, a 
bridge indicator -amplifier, and a 24 -position rotary switch. The resistance bridge 
was dual range from 0 to 2. 999 ohms and from 0 to 29. 99 ohms and included a four- 
digit selector -indicator for balancing the circuit and for displaying the value of the 
measured resistance. Accuracy of the bridge circuit was ±0. 15 percent. The 
indicator -amplifier portion of the circuit included a null meter with a zero-center scale. 
The alternating -current (ac)/dc/ohm circuit consisted of a meter -amplified circuit and 
a dual -deck rotary switch. The ac/dc/ohm circuit provided the following functions: 

(1) selection and measurement of both positive and negative dc voltages, (2) selection 
and measurement of ac voltages at frequencies as high as 20 000 hertz, and (3) a means 
for performing continuity tests. The meter -amplifier portion of the circuit included an 
indicator with dual linear scales of 0 to 10 millivolts and 0 to 100 millivolts and a 0- to 
5 -ohm scale with midscale reading of 1 ohm. Power for the bridge circuit and for the 
ac/dc/ohm circuit was provided by internal batteries. The set included 22 two-pin 
dummy initiators. The dummy initiators consisted of a potentiometer that could be 
adjusted between 0.95 and 1. 15 ohms. The original unit, using the basic Wheatstone 
bridge concept, could not meet the specifications for resistance measuring accuracy. 
The requirements were met by including a dc amplifier between the bridge circuit and 
the null meter. This arrangement increased the null indication accuracy and, thereby, 
the accuracy of the measuring unit. 

The pyrotechnic bridge checkout unit. - The pyrotechnic bridge checkout unit 


checkout test set and, in addition, could be controlled remotely at the launch site. The 
unit was used to check the circuit resistance of the launch-escape motor, of the tower- 
jettison motor, and of the SLA separation system, because these circuits were consid- 
ered to be potentially hazardous to personnel in the area when fired. In size, the 
pyrotechnic initiator bridge unit was 12 by 12 by 18 inches, the remote control panel 
assembly was 5. 5 by 6 by 19 inches, and the dummy was 1. 5 by 1. 5 by 4 inches. The 
system weighed approximately 100 pounds and was designed to be portable. 

The explosive device test set . - The explosive device test set was used for no- 
voltage tests and electrical resistance measurements of the LM pyrotechnic circuitry 
before and after installation of flight ordnance. The test set (fig. 41) was a suitcase - 
type configuration that contained a resistance measuring unit, a 500-volt megohmmeter, 
and the associated batteries and switches. A cable set was provided to effect an inter- 
face with the LM vehicle. The unit measured 20 by 10 by 10 inches and weighed 
51 pounds. 



Figure 41. - Explosive device test set. 


The resistance measuring portion of 
the test set was used to measure and dis- 
play the circuit resistance of the LM 
pyrotechnic circuitry. A removable, panel - 
mounted megohmmeter was used to measure 
and display the isolation resistance of the 
LM pyrotechnic circuitry. The power sup- 
ply provided the necessary power to operate 
relays in the relay box. The power supply 
included current -limiting and protective 
devices to prevent high currents from flow- 
ing in the pyrotechnic circuitry if a failure 
occurred. The monitor and control panel 
was capable of the following functions: 

(1) the selection of subassemblies, specific 
stimuli, and monitoring points; (2) mechani- 
cal mounting of the resistance measuring 
unit and the megohmmeter; and (3) visual 
displays of ac and dc voltages, of pyrotech- 
nic battery voltage, of internal power sup- 
ply voltage, of battery polarity, and of the 
state of gaseous purge when pressurized for 
use in hazardous gaseous areas. 


The current regulator . - The current regulator was used in conjunction with the 
explosive device test set to limit the spacecraft power bus current to a safe level during 
pyrotechnic circuit testing after the flight pyrotechnics were installed in the vehicle. 

The unit (fig. 42) was portable, had dimensions of 18 by 12 by 12 inches, and weighed 
15 pounds. Mating connectors were supplied both for the LM electrical power bus and 
for the ground power. The current regulator controlled the output power of a 2 8 -volt 
dc, 250-ampere power supply. In the bypass mode, the regulator was capable of 
carrying and breaking a current of 150 amperes at 28 volts dc. In the current -limiting 
mode, the minimum output current was 100 milliamperes. The limiting current level 
was adjustable continuously from 300 to 500 milliamperes. When the limiting current 
level was reached, the circuits were opened. The circuits remained open until the 
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Figure 42. - Current regulator. 


r 



regulator was reset. The controls and indi- 
cators included a two -position, key -actuated 
switch and an indicator -light read-out of the 
selected mode. Provision also was made 
for remote read-out of the selected mode in 
the form of 2 8 -volt dc signals. A functional 
diagram of the current regulator is shown in 
figure 43. 

The only problems were premature 
opening of circuits because of the occur- 
rence of ground loops and capacitive effects 
in the facility wiring. The regulator was 
modified to correct the problems. 

The pyroharness shorting plugs and 
cable set. - The pyroharness shorting plugs 
and cable sets were used to short circuit 
and to ground the CM forward compartment 
initiator circuits. The live pyrotechnic de- 
vices were installed at the manufacturing 
plant during the buildup of the forward com - 
partment. The inaccessibility of the pyro- 
technic devices in the forward compartment 
made removal after installation impractical. 
The cables were mated with the pyrotechnic 
continuity verification box or the lunar dock- 
ing events controller. The shorting plugs 
were removed at the appropriate time during 
the prelaunch operations at the launch site. 
The plug and cable set consisted of six cable 
assemblies (fig. 44). 


6 pyrotechnic initiators 6 pyroharness shorting 

I ocated i n the fo rwa rd plugs 1 ocated i n th e c rew 

compartment area compartment area 



Figure 44. - Pyroharness shorting 
plugs and cable set. 


Figure 43. - Functional block diagram 
of the current regulator. 
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CONCLUSIONS 


The pyrotechnic device offered a convenient means to the spacecraft engineer for 
accomplishing numerous functions in the spacecraft systems. The large number and 
variety of critical functions performed by Apollo spacecraft pyrotechnic devices im- 
posed an obligation to provide the most reliable and the safest system devised for aero- 
space applications to that point in time. This obligation was met by initially considering 
each pyrotechnic component as an integral and critical part of an overall system and by 
then conducting appropriate design reviews and evaluations to ensure that every con- 
ceivable variable in the system was controlled. The magnitude and complexity of prob- 
lems were minimized by using conventional electrical and mechanical components 
wherever possible. New and unfamiliar requirements necessitated experimental and 
analytical studies that, in some cases, uncovered a number of potentially serious 
problems, which, if not uncovered at an opportune time, would have resulted in costly 
rework and a severe strain on space program objectives. An outstanding example is 
the incompatibility problem associated with the use of RTV 30-121 adhesive to bond 
lead-sheath explosive -core charges in the spacecraft/lunar module adapter charge - 
holders. Had the problem not been uncovered during almost routine in-house tests, it 
is possible that the condition could have resulted in failure to separate during a mission. 
Other examples include the docking tunnel separation system redundancy question and 
the Apollo standard initiator sensitivity problem. Costly rework or redesign (or both) 
of the docking ring separation system was avoided because results of analytical tests 
and experiments proved the system to be reliable and redundant with only relatively 
minor corrections. As a result of exhaustive evaluation programs to search out hidden 
weaknesses in the Apollo standard initiator design, the possibilities of both a premature 
fire and a misfire occurring during flight were uncovered. 

Although there is no question as to the suitability, quality, and reliability of 
Apollo pyrotechnic devices for applications in Apollo systems, and the desirability of 
using devices having high reliability is not open to question, the methods employed to 
attain and to demonstrate confidence in reliability for a number of Apollo devices were 
not the most efficient or the most practical. As shown in the examples, most Apollo 
pyrotechnic devices did not provide for reliability control or monitoring before the 
evaluation phase, and design information was generated largely through intuition rather 
than through a combination of scientific approach, statistical experimentation, and 
subsequent observation. As a result, in a number of cases, a considerable amount 
of hardware that was ordered or acquired could not be used when the design was later 
found to be deficient, usually at a time which was too late to make modifications eco- 
nomically or to redesign for reliability improvement. Often, the funds already spent 
were too great to be written off, and it was considered to be more expedient to add 
funds in an attempt to make a product improvement. Another reason for the hardware 
problems was that development time was not available for redesign. 

Although the reliability probability of each device was established at design con- 
ception, the evaluation, qualification, and production acceptance tests and the flight 
use of the devices contributed to confidence in the reliability of the design. This con- 
fidence was enhanced further by following the policy of standardization of components 
wherever possible. 
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Within the pyrotechnics area, the most outstanding example of the potentialities 
in following the policy of standardization of components is the exclusive use by the 
Manned Spacecraft Center of the standard initiator in all Apollo spacecraft applications 
requiring electrical initiation. Maintaining standardization required considerable 
effort on a continuing basis but proved worthwhile in enhanced system reliability and 
reduction of total program cost, as a result of eliminating multiple initiator develop- 
ment programs. 

By strict adherence to the philosophy of concentrated attention to all details of 
design, including inert and explosive materials used in the construction of all compo- 
nents and systems, the Apollo spacecraft pyrotechnic systems played a major and very 
important role in the resultant highly successful Apollo Program. 


RECOMMENDATIONS 


Future manned -space -flight technology will place a greater demand on extremely 
sophisticated, reliable, compact, and lightweight pyrotechnic devices. The primary 
purpose of a reliability program for future systems should be to ensure that reliability 
is treated as a design parameter of equal importance with performance parameters 
during the initial design-conception phase as well as during the evaluation of a proto- 
type design. The approach to design and development must be more fundamental than 
that taken during development of Apollo pyrotechnic devices, where the "cut and try" 
method was used in most instances. Adequate information is available and should be 
used to assist the design engineer in the selection of proper materials in any given 
development program. Proper knowledge of the candidate materials and components, 
of their behavior and characteristics, and of the specific requirements that the end 
item must meet should be acquired before design can begin. Just as important are the 
manufacturing, handling, and testing of these components and materials, because vari- 
ables can have a dramatic effect on the performance and functioning of the end device. 

Qualification of safe, reliable pyrotechnic systems for future programs can come 
about more efficiently and effectively if, during initial design and development, detailed 
and in-depth knowledge is obtained of all aspects of the design encompassing a full 
cross section of the capabilities as well as the limitations of the system. This "keeping 
abreast" can be accomplished most effectively by maintaining close control of proc- 
esses, equipment, and facilities used to manufacture and qualify any specific item. 
Unfortunately, it was not until the latter part of the Apollo device development programs 
that measures to control and maintain homogeneity of a product or design were attained. 
A method of lot certification was developed to certify ordnance devices for flight. This 
technique was used to purge the system of all nonflightworthy hardware and has pro- 
duced the desired results as no known failures have occurred in flight. It is recom- 
mended that, for future systems, configuration and process control should be maintained 
by system engineers from the time of initial design concept to final delivery of the prod- 
uct. The most effective way of accomplishing this control is to provide a repeatable 
method of producing a given product with the use of definitive written instructions that 
cover all facilities, equipment, instrumentation, and processes used in the manufac- 
ture, qualification, and final production of the end item. 
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Although there is no question concerning the suitability of pyrotechnic devices 
developed for Apollo spacecraft use, experience has shown that several components 
might require improvement or redesign to meet more stringent requirements for mis- 
sions of longer duration than the Apollo missions. These components are described in 
the following paragraphs. 


Single Bridgewire Apollo Standard Initiator 

Meeting electromagnetic -interference and radio -frequency -interference problems 
associated with long -duration missions may be impossible with the present design be- 
cause of more powerful radar and communication systems requirements. On long- 
duration missions, it becomes impractical to use separate power supplies (as was the 
case on the Apollo missions) for ordnance systems. Therefore, power supplies will 
have to be shared with main spacecraft systems. As a consequence, ordnance cir- 
cuitry will have to survive higher electromagnetic -interference levels to which the 
present initiator may not be tolerable. 

The single bridgewire Apollo standard initiator consists of 12 basic parts. In 
addition to modification necessary to meet future requirements, an attempt should be 
made to produce the unit more economically. It is conceivable that, with the use of 
an ignition material having better electrical characteristics than the present mix, a 
unit can be made from as few as three parts. A minimum number of parts will enhance 
the reliability of the unit as well as decrease the cost. The ultimate objective should 
be to develop a cheaper electric initiator that inherently jvould be immune to electrical 
problems associated with the Apollo unit. 


Explosive Trains and Interfaces 

With only a few exceptions, cyclotrimethylenetrinitramine was used as the high- 
explosive material throughout the Apollo command and service module systems. How- 
ever, of prime importance is potential degradation of the chemical stability of the 
explosive when exposed to an extended high vacuum environment. New, recently de- 
veloped temperature - and vacuum -resistant high -explosive materials should be 
exploited for use in development of new systems for future programs. Some of these 
new materials (e. g. , hexanitrostilbene) were incorporated into the design of some 
lunar module and command module devices. 

Lead azide was used as the primary explosive for the initiation of high explosives 
in the Apollo systems. Lead azide has some undesirable properties, including incom- 
patibility with other organic explosives at elevated temperatures, that might limit its 
usefulness in future programs. New initiator materials should be evaluated for use, if 
situations occur where a replacement is needed. These materials should be tempera- 
ture and vacuum resistant and should be compatible with other explosives at elevated 
temperatures. 

A potential problem associated with core charges is the interface. A consider- 
able amount of improvement is needed over the approaches taken on Apollo systems, 
where the "over-kill" philosophy in detonation transfer was used throughout. For 
example, in practically all designs of Apollo explosive train systems containing right 
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angles, an overpowered and cumbersome system was used to overcome the unreliabil- 
ity of the system because of the strong anisotropic characteristics of explosives in 
general. Such a cumbersome approach is unnecessary if, during initial development, 
the proper design is used to either eliminate the necessity for right -angle turns or, if 
necessary, provide for reliable detonation transfer across the right -angle turn. 


Separation Systems 

Separation systems used in the Apollo Program were neither entirely consumable 
nor free from smoke and debris. Also, shock induced into other systems has created 
areas of concern. It is recommended that new separation systems be developed to 
include one or a combination of the following characteristics: (1) be entirely consum- 
able, (2) be smoke free, (3) be debris free, and (4) have low shock levels. 


Reefing Line Cutters 

As is characteristic of all pyrotechnic delay systems, the Apollo reefing line 
cutter was lacking in timing reliability and reproducibility when compared to mechani- 
cal or electronic delay systems. A small, reliable, electrically initiated and timed 
reefing line cutter with built-in delay should be developed as a replacement for the con- 
ventional mechanically actuated and pyrotechnic timed type. To overcome the poor 
characteristics of pyrotechnic delay systems, a small solid-state ignition and electronic 
delay system should be used in a cutter no larger than the Apollo cutter. 


Firing Circuitry 

Based on experience gained from designing the Apollo spacecraft pyrotechnic fir- 
ing circuitry and the expected power and radio -frequency requirements for longer dura- 
tion missions, future design features should include the following. 

1. The circuitry should be completely redundant, and the redundancy should be 
both parallel and series. Parallel redundancy is required to obtain the reliability 
necessary for proper function, and series redundancy is required to avoid premature 
pyrotechnic functioning. Redundancy should not be defeated by using system intercon- 
nects and crossovers. 

2. Checkout and inspection capability should be considered during initial design 
of the system. Electrical access points that allow checkout of the system without 
breaking any flight connections should be provided. The checkout capability should 
provide for verification of initiator bridgewire resistance after the last electrical con- 
nection is made. The design of checkout equipment must be considered as a part of 
the overall system design to prevent expensive wasted effort resulting in useless 
equipment. 

3. For longer duration missions, firing energy probably will be supplied from 
the main power source of the vehicle; that is, from fuel cells, solar panels, or atomic 
energy. Special design consideration should be given to methods for prevention of 
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excessive electromagnetic interference and bus-voltage variations. Possible solutions 
would be the use of line filters and smoothing capacitors. 

4. Future missions will require higher vehicle radio -frequency -interference 
environments because of greater power output levels from radar and communication 
equipment. To prevent radio -frequency -interference problems in pyrotechnic systems, 
a combination of improved explosive devices and improved control circuitry will be 
required. Good design practices, such as twisted, shielded firing circuit leads, should 
be retained; but, to be effective, the use of good design ideas must be included in the 
original concept of future spacecraft and not be patched and placed on the completed 
system as afterthoughts. To be completely effective, a shield must completely cover 
the circuit being protected, and penetration of the shield must be by way of filters to 
prevent "contamination of the clean system" by radio -frequency interference. Shielding 
on Apollo systems was implemented haphazardly and contained holes and breaks at bulk- 
heads and other places, because standard electrical connectors were used. In some 
cases, the connectors were patched and modified in an attempt to meet radio -frequency - 
interference requirements. Many problems in system function resulted because of 
electrical shorts created by the patching and modifying of the standard connectors. 
Radio-frequency-type connectors should have been designed into the initial Apollo 
systems. 

5. All future electrical systems should be electrically isolated from vehicle 
structures, and electromagnetic and radio-frequency interference should be reduced by 
keeping the systems electrically balanced so that the interference signals cancel each 
other. The isolated electrical systems also will greatly decrease the probability of 
problems from electrical short circuits, because a short of either the hot or return 
circuit to the vehicle structure would have no effect on performance. 
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